Re: URGENT BUGS TO FIX IN THE FILE SYSTEM, KERNEL PANICS, INT OVERFLOWS, ETC.

Please do proper kernel bug reporting, which means "don't just sent to
Linus", but figure out the maintainer etc. We have documentation about
this all.

That filesystem isn't a serious filesystem, and that code needs a lot
more fixing if somebody cares.

Instead of doing

        if (affs_validblock(sb, block)) {
                bh = sb_getblk(sb, block);

it should probably just do

        bh = affs_getblk(sb, block);
        if (bh) {

instead, but honestly, I can't find it in myself to care about an
unlikely error case that nobody has ever seen and reported, all in a
legacy Amiga filesystem that nobody really uses outside of hobby Amiga
enthusiasts.

But we do have a listed sucker^Hmaintainer for it that says "Odd
Fixes", and this certainly counts as an odd fix.

So I'm cc'ing David and fsdevel in case there is somebody else with an
Amiga background.

Me, I'm still bitter about those rich kids with their fancy sprites on
their Amiga HW, which may be one reason I don't feel like fixing the
problems in AFFS ;)

               Linus


On Wed, 29 Jul 2026 at 17:05, Agamalt 10 <[email protected]> wrote:
>
> In here https://github.com/torvalds/linux/blob/master/fs/affs/affs.h:
>
> You have:
>
> bh = sb_getblk(sb, block);
> lock_buffer(bh);
> but, sb_getblk() can return NULL on failure.
>
> If allocation fails:
>
> bh = NULL;
> lock_buffer(NULL);
>
> → kernel crash.
>
> Same problem for bh = sb_getblk(sb, block);
>
> wait_on_buffer(bh);
> Also, an INT overflow risk here:
> #define AFFS_TAIL(sb, bh) \
> ((struct affs_tail *)((bh)->b_data+(sb)->s_blocksize-sizeof(struct affs_tail)))
>
> If:
>
> sb->s_blocksize < sizeof(struct affs_tail)
>
> the subtraction underflows because s_blocksize is unsigned internally.